CVE-2026-59976

ConvertX is a self-hosted file conversion service. Prior to 0.18.0, the ImageMagick converter uses the unsanitized convertto parameter to construct an output path. If an authenticated user, or an unauthenticated user when ConvertX is configured to allow unauthenticated access, uploads an...

CVE-2026-59977

ConvertX is a self-hosted file conversion service. Prior to 0.18.0, the /delete/id endpoint uses HTTP GET for permanent deletion without CSRF protection. If an authenticated user visits attacker-controlled content that requests /delete/id, the browser sends the user session cookie and the request...

CVE-2026-59976

The self-hosted file conversion service ConvertX is vulnerable to a path traversal vulnerability in versions prior to 0.18.0 . The ImageMagick converter fails to sanitize the convert_to parameter used to construct output paths. By uploading an extensionless image and providing directory traversal...

CVE-2026-59976 ConvertX: Path Traversal vulnerability leading to Arbitrary File Write

ConvertX is a self-hosted file conversion service. Prior to 0.18.0, the ImageMagick converter uses the unsanitized convertto parameter to construct an output path. If an authenticated user, or an unauthenticated user when ConvertX is configured to allow unauthenticated access, uploads an...

CVE-2026-59976 ConvertX: Path Traversal vulnerability leading to Arbitrary File Write

ConvertX is a self-hosted file conversion service. Prior to 0.18.0, the ImageMagick converter uses the unsanitized convertto parameter to construct an output path. If an authenticated user, or an unauthenticated user when ConvertX is configured to allow unauthenticated access, uploads an...

CVE-2026-59977

The ConvertX self-hosted file conversion service is vulnerable to Cross-Site Request Forgery (CSRF) in versions prior to 0.18.0 . The vulnerability exists because the /delete/{id} endpoint performs permanent deletions using HTTP GET requests without CSRF protection. An attacker can trick an authe...

CVE-2026-59977 ConvertX: Cross-Site Request Forgery (CSRF) leading to Unauthorized Data Destruction

ConvertX is a self-hosted file conversion service. Prior to 0.18.0, the /delete/id endpoint uses HTTP GET for permanent deletion without CSRF protection. If an authenticated user visits attacker-controlled content that requests /delete/id, the browser sends the user session cookie and the request...

CVE-2026-59977 ConvertX: Cross-Site Request Forgery (CSRF) leading to Unauthorized Data Destruction

ConvertX is a self-hosted file conversion service. Prior to 0.18.0, the /delete/id endpoint uses HTTP GET for permanent deletion without CSRF protection. If an authenticated user visits attacker-controlled content that requests /delete/id, the browser sends the user session cookie and the request...

CVE-2026-59976: Improper Limitation of a Pathname to a Restricted Directory

ConvertX is a self-hosted file conversion service. Prior to 0.18.0, the ImageMagick converter uses the unsanitized convertto parameter to construct an output path. If an authenticated user, or an unauthenticated user when ConvertX is configured to allow unauthenticated access, uploads an...

CVE-2026-59977: Cross-Site Request Forgery (CSRF)

ConvertX is a self-hosted file conversion service. Prior to 0.18.0, the /delete/id endpoint uses HTTP GET for permanent deletion without CSRF protection. If an authenticated user visits attacker-controlled content that requests /delete/id, the browser sends the user session cookie and the request...

CVE-2026-108694

ConvertX through 0.19.0 contains an arbitrary file read vulnerability that allows authenticated users to read server files because src/converters/pandoc.ts invokes Pandoc without the --sandbox flag. Attackers can upload a reStructuredText document with an include directive naming an absolute path...

CVE-2026-108694

ConvertX versions through 0.19.0 are vulnerable to an arbitrary file read vulnerability. The root cause is located in src/converters/pandoc.ts, where the application invokes Pandoc without the --sandbox flag. This allows authenticated users to upload a reStructuredText document containing an incl...

CVE-2026-108694 ConvertX through 0.19.0 Arbitrary File Read via Pandoc Converter

ConvertX through 0.19.0 contains an arbitrary file read vulnerability that allows authenticated users to read server files because src/converters/pandoc.ts invokes Pandoc without the --sandbox flag. Attackers can upload a reStructuredText document with an include directive naming an absolute path...

CVE-2026-108694

ConvertX through 0.19.0 contains an arbitrary file read vulnerability that allows authenticated users to read server files because src/converters/pandoc.ts invokes Pandoc without the --sandbox flag. Attackers can upload a reStructuredText document with an include directive naming an absolute path...

EUVD-2026-96697

ConvertX through 0.19.0 contains an arbitrary file read vulnerability that allows authenticated users to read server files because src/converters/pandoc.ts invokes Pandoc without the --sandbox flag. Attackers can upload a reStructuredText document with an include directive naming an absolute path...

CVE-2026-108694 ConvertX through 0.19.0 Arbitrary File Read via Pandoc Converter

ConvertX through 0.19.0 contains an arbitrary file read vulnerability that allows authenticated users to read server files because src/converters/pandoc.ts invokes Pandoc without the --sandbox flag. Attackers can upload a reStructuredText document with an include directive naming an absolute path...

CVE-2026-108694: External Control of File Name or Path

ConvertX through 0.19.0 contains an arbitrary file read vulnerability that allows authenticated users to read server files because src/converters/pandoc.ts invokes Pandoc without the --sandbox flag. Attackers can upload a reStructuredText document with an include directive naming an absolute path...

PT-2026-109988

Name of the Vulnerable Software and Affected Versions ConvertX versions prior to 0.19.1 Description Authenticated users can read server files because the src/converters/pandoc.ts file invokes Pandoc without the --sandbox flag. An attacker can exploit this by uploading a reStructuredText document...

CVE-2026-105080

In ConvertX before 0.19.0, converters/calibre.ts does not block recipe files, and instead passes them to the ebook-convert program from Calibre. This affects executable code in a .recipe or .downloadedrecipe file...

CVE-2026-105080

In ConvertX before 0.19.0, converters/calibre.ts does not block recipe files, and instead passes them to the ebook-convert program from Calibre. This affects executable code in a .recipe or .downloadedrecipe file...